DPA case 109/2024 – Complaint Upheld (Belgium, 2024)

A data subject received a mortgage offer from a company. The data subject was also offered a discount on the interest rate for the mortgage. However, in order to qualify for the discount, the data subject had to take out a debt balance insurance offered by a broker (the controller). For taking out the insurance, the data subject had to give consent for the processing of their health data. According to the data subject, the consent covered not only the handling of the insurance contract, but also other purposes, for example, claims processing, fraud prevention, development of pricing and automated decision making. The data subject asked the controller to rephrase the consent, so that it was more specific. However, the controller did not agree. Since the data subject did not want to lose the discount on the interest rate, they eventually gave the consent for processing their health data. Afterwards, the data subject sent the controller an email in which they: * withdrew the consent regarding the processing of health data and automated decision making; * requested restriction of data processing until the legal basis of processing was clarified; * requested correction of signed documents. The controller answered the requests and provided the data subject with a copy of their data. The data subject filed a complaint with the Belgian DPA (APD/GBA). The DPA upheld the complaint. First, the DPA found the controller failed to obtain valid consent for data processing. Indeed, the consent given by the data subject was not freely given. This was because the data subject would have faced negative consequences if they had not given the consent. Thus, the controller violated Article 4(11), 7(1), 7(3) and 9(2)(a) GDPR. Even though the controller violated the GDPR, the DPA decided not to take any corrective measures. The DPA held that the controller was not culpable because the Belgian legislator failed to implement Article 9(2) GDPR insofar it would provide a specific